Collect and verify the USN journal¶
Journey 02
The case owner needs a journal from the affected Windows volume. Choose one collection route, inspect the extraction result and preserve a verified working copy. Finish with: a binary, log, source identity, collection times and SHA-256 record.
Collect and verify¶
1. Identify your source¶
Before running a command
Record the case, authority, host or image identifier, source SHA-256 where applicable, filesystem, volume mapping and time zone. Confirm destination capacity and a separate output location. Drive letters and volume numbers below are examples, not discovery results. Do not assume volume 1 is the Windows partition.
2. Choose one collection route¶
Preferred evidence route: verified raw image
Use your acquisition or image inspection tool to confirm the NTFS partition and its mapping. Substitute the verified image path and correct volume number. Create and verify the destination directory first. In 1.0.0.5 an absent /OutputPath directory falls back to the program directory; the switch alone does not guarantee the destination.
mkdir E:\Cases\USN-1042\raw
.\ExtractUsnJrnl64.exe /ImageFile:D:\Evidence\disk.dd /ImageVolume:1 /OutputPath:E:\Cases\USN-1042\raw /OutputName:WIN-LAB01_USN.bin > E:\Cases\USN-1042\raw\extract-log.txt 2>&1
type E:\Cases\USN-1042\raw\extract-log.txt
The redirection saves console messages, including errors, in the collection log. Retain the exact command separately. Inspect the log and file rather than treating a returned prompt as proof of success.
Authorised live collection: a known NTFS volume
On a disposable lab endpoint, open Command Prompt as administrator. Confirm C: is the intended source and E: is your separate evidence destination, then run:
mkdir E:\Cases\USN-1042\raw
.\ExtractUsnJrnl64.exe /DevicePath:C: /OutputPath:E:\Cases\USN-1042\raw /OutputName:WIN-LAB01_USN.bin > E:\Cases\USN-1042\raw\extract-log.txt 2>&1
type E:\Cases\USN-1042\raw\extract-log.txt
Record start/end times and live system changes. A live journal can change during collection; repeated outputs may differ. Do not create, delete or reset the journal on original evidence to make extraction work.
Advanced source: an existing shadow copy
Identify an existing shadow copy, its originating volume and snapshot time before selecting it. The device numbers in these examples are placeholders; HarddiskVolumeShadowCopy1 may not exist on your system.
.\ExtractUsnJrnl64.exe /DevicePath:\\.\HarddiskVolumeShadowCopy1 /OutputPath:E:\Cases\USN-1042\raw /OutputName:SC1_USN.bin
A snapshot answers a question about its captured state. Label it separately from live evidence. Preserve the source mapping and snapshot time with the output.
3. Validate and preserve the binary¶
dir E:\Cases\USN-1042\raw\WIN-LAB01_USN.bin
certutil -hashfile E:\Cases\USN-1042\raw\WIN-LAB01_USN.bin SHA256
mkdir E:\Cases\USN-1042\working
copy /b E:\Cases\USN-1042\raw\WIN-LAB01_USN.bin E:\Cases\USN-1042\working\WIN-LAB01_USN.bin
certutil -hashfile E:\Cases\USN-1042\working\WIN-LAB01_USN.bin SHA256
Record the exact byte count and full 64-character SHA-256. Compare the two hashes, retain the raw output unchanged, and process only the working copy. Use a new run folder for repeat collections. The documented behaviour attempts to rename an existing same name output with a .renamed_<timestamp> suffix; do not rely on this as your case versioning scheme. A nonempty file and matching copy hashes establish useful checks, but do not establish that the journal is complete or that it covers the incident.
Troubleshooting¶
| What you observe | What to check next |
|---|---|
| Help appears instead of collection | Verify argument names, colons and values against your installed help. |
| Access denied or device cannot be opened | Confirm authority, elevation, source existence and device mapping; do not disable security controls as a shortcut. |
| Filesystem is not NTFS | Recheck partition selection, image format and whether encryption prevents NTFS access. Preserve logs before changing approach. |
| Missing or zero length output | Inspect errors, journal availability, destination permissions and free space. Absence is not evidence of no activity. |
| Parser returns no expected filename | Check source volume, time window, renamed variants, parser compatibility and journal retention. |
| Two live collections have different hashes | Preserve both; compare collection times and logs. Live filesystem activity can change the journal. |
Keep uncertain results as limitations in the case note. Journal retention is finite and coverage must be established; failure to find a record cannot rule out the activity.
Verification scope and primary references
Reviewed on 19 September 2026 against the ExtractUsnJrnl 1.0.0.5 source and author's usage notes. Case paths, exercise times and synthetic records are teaching data, not facts about your system. Evidence preservation steps are analyst practice, not functions automatically performed by the tool.
Extraction commands and source modes were checked against the source and usage notes. Live volume, image and shadow copy acquisition were not executed during this review; test the installed build with known input before casework.